ZHNFIREWALL

All MIBs › ZHNFIREWALL

Organization: Zhone Technologies, Inc.

Last Updated: 2012-04-18

Category: Network Security and Firewalls

Description: Manages Zhone Technologies CPE firewall rules, NAT configuration, and packet filtering policy settings.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is ZHNFIREWALL?

ZHNFIREWALL is a Zhone Technologies enterprise MIB that defines LAN management-access filtering and port-forwarding objects for Zhone customer-premises equipment (CPE), mapping directly onto the TR-069 X_ZHONE_MgmtAccessCfg and X_ZHONE_PortForwardingCfg data models. The firewallMgmtAccessTable lets an operator block or allow specific management protocols -- HTTP, HTTPS, ping, SNMP, SNMP trap, SSH, and Telnet -- per LAN interface via firewallMgmtAction, hardening the device's own management plane against external attacks. The firewallPortForwardingTable configures NAT/port-forwarding rules, each specifying a firewallPortType (port range, port remap, or DMZ), a firewallPortProtocol (TCP/UDP/ICMP), a public port range, a private port, and the private IP address traffic is forwarded to, with lifecycle managed through a Zhone-specific RowStatus. As a configuration MIB, monitoring it is mainly about auditing which management services are exposed and which forwarding/DMZ rules are active, since these rules only take effect once the CPE's global firewall object is enabled. It depends on the ZHNLANDEVICE MIB for its lanDeviceIndex/lanEthernetIndex table indexes and the Zhone/Zhone-TC enterprise trees for common types, and it is deployed on Zhone CPE gateways, and administrators can download the ZHNFIREWALL MIB to audit or automate these firewall rules.

IPNetwork Monitor allows you to monitor SNMP objects defined in ZHNFIREWALL. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Zhone Technologies CPE gateways

Monitoring Examples

An operator walks firewallMgmtAccessTable to confirm telnet and http management access are set to deny(2) rather than allow(1), and reviews firewallPortForwardingTable for any DMZ(3) rule; a DMZ rule with a stale firewallPortPrivateIPAddress pointing at a decommissioned host would indicate a forgotten forwarding rule exposing an internal device to all inbound ports.

What Can Be Monitored

management-access service block/allow state (HTTP, SSH, Telnet, etc.)
port-forwarding rule type (range/remap/DMZ)
forwarded protocol and port ranges
private IP address of forwarding targets
port-forwarding rule row status

Imported Objects

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Gauge32
Integer32
IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32
enterprises

From SNMPv2-TC

MacAddress
RowStatus
TEXTUAL-CONVENTION
TruthValue

From Zhone

zhoneWtn

OBJECT-IDENTITY

From Zhone-TC

ZhoneRowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
firewallMgmtAccessEntry	1.3.6.1.4.1.5504.2.5.45.1.1.1		not-accessible	Table of entries of LAN Management Access service filters. This table is used to configure management access on the device. It is useful in making the device management network by blocking protocols or services that are highly susceptible to external attacks.
firewallMgmtAccessTable	1.3.6.1.4.1.5504.2.5.45.1.1		not-accessible	Table of LAN Management Access Service Filters
FIR firewallMgmtAction	1.3.6.1.4.1.5504.2.5.45.1.1.1.3	FirewallMgmtAccessServiceActions	read-write	LAN Management Access Service filtering action. Enumerated values: Allow (1), Deny (2), Undefined (3)
OCT firewallMgmtService	1.3.6.1.4.1.5504.2.5.45.1.1.1.2	OCTET STRING	read-only	LAN Management Access Service description.
FIR firewallMgmtServiceIndex	1.3.6.1.4.1.5504.2.5.45.1.1.1.1	FirewallMgmtAccessServiceValues	not-accessible	LAN Management Access Services Table index. Enumerated values: Http (1), Https (2), Ping (3), Snmp (4), SnmpTrap (5), Ssh (6), Telnet (7)
firewallPortForwardingEntry	1.3.6.1.4.1.5504.2.5.45.1.2.1		not-accessible	This table is used to configure port forwarding firewall rules for the device.
U32 firewallPortForwardingIndex	1.3.6.1.4.1.5504.2.5.45.1.2.1.1	Unsigned32	not-accessible	LAN Port Forwarding Rules index.
OCT firewallPortForwardingName	1.3.6.1.4.1.5504.2.5.45.1.2.1.2	OCTET STRING	read-write	Descriptive name for a LAN Port Forwarding Rule.
ZHO firewallPortForwardingRowStatus	1.3.6.1.4.1.5504.2.5.45.1.2.1.9	ZhoneRowStatus	read-write	The SNMP RowStatus of the current row. The following objects must be specified upon row creation: firewallPortForwardingName firewallPortPrivateIPAddress
firewallPortForwardingTable	1.3.6.1.4.1.5504.2.5.45.1.2		not-accessible	Table of LAN Port Forwarding Rules. Note that the rules in this table have no effect until the global firewall object (sysFirewallEnable) is enabled.
IP firewallPortPrivateIPAddress	1.3.6.1.4.1.5504.2.5.45.1.2.1.8	IpAddress	read-write	The port IP Address with which to send the traffic.
U32 firewallPortPrivatePort	1.3.6.1.4.1.5504.2.5.45.1.2.1.7	Unsigned32	read-write	The port number with which to send the traffic.
FIR firewallPortProtocol	1.3.6.1.4.1.5504.2.5.45.1.2.1.4	FirewallPortProtocolValues	read-write	Enumerated value of: tcp (1), udp (2), tcpOrUdp (3), icmp (4), icmpv4 (5), none (6)
U32 firewallPortPublicPortEnd	1.3.6.1.4.1.5504.2.5.45.1.2.1.6	Unsigned32	read-write	Highest value port number for the range. This can be equal to firewallPortPublicPortStart if there is only one port.
U32 firewallPortPublicPortStart	1.3.6.1.4.1.5504.2.5.45.1.2.1.5	Unsigned32	read-write	Lowest value port number for the range.
FIR firewallPortType	1.3.6.1.4.1.5504.2.5.45.1.2.1.3	FirewallPortTypeValues	read-write	Enumerated value of: portRange (1), -- Range indicates that any traffic on those ports will be -- sent to the private IP address. portRemap (2), -- Remap indicates that any traffic on those ports will be -- sent to the private IP address at the private port. dmz (3) -- When DMZ is chosen it is the only rule allowed on that -- interface. A DMZ rule is effectively the same as a Range -- rule with all ports included. Range rules are more secure -- than setting a DMZ rule, because Range rules allow specific -- ports or groups of ports to be opened up.
zhnFirewall	1.3.6.1.4.1.5504.2.5.45			This file defines the private Enterprise MIB extensions that define LAN Management Access Service Filters and Port Forwarding objects supported by the Zhone CPEs.
zhnFirewallCompliance	1.3.6.1.4.1.5504.2.5.45.3.2.1			The Compliance statement for SNMP entities which manage the Zhone CPE LAN Firewall Management Access Services and Port Forwarding Information
zhnFirewallCompliances	1.3.6.1.4.1.5504.2.5.45.3.2
zhnFirewallConformance	1.3.6.1.4.1.5504.2.5.45.3
zhnFirewallGroups	1.3.6.1.4.1.5504.2.5.45.3.1
zhnFirewallMgmtAccessGroup	1.3.6.1.4.1.5504.2.5.45.3.1.1			A collection of Zhone IP objects that describe the LAN Management Access Services that can be filtered for a particular LAN interface.
zhnFirewallObjects	1.3.6.1.4.1.5504.2.5.45.1
zhnFirewallPortForwardingGroup	1.3.6.1.4.1.5504.2.5.45.3.1.2			A collection of Zhone IP objects that describe the LAN Port Forwarding Management rules for filtering protocols and ports for a particular LAN interface.

RFC description

Zhonghua Network firewall management MIB; manages firewall rules, connections, and security policies for ZHN security appliances.

Start monitoring Zhone Technologies CPE gateways (management-access-filter/port-forwarding config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download ZHNFIREWALL

What Is ZHNFIREWALL?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description